Application of direct marketing principle to agencies

26.34 Before considering the content of the direct marketing principle, first it is necessary to consider what entities should be bound by the principle. Currently, organisations must comply with the direct marketing provisions in NPP 2.1(c) where direct marketing does not fall within one of the other limbs of the use and disclosure principle in NPP 2. On the other hand, agencies are not subject to any express regulation of direct marketing in the IPPs.

26.35 The OPC’s guidelines on the IPPs state that ‘agencies’ are generally federal government organisations, but notes that some types of organisations, ‘even if set up by federal government laws’, are not agencies.[48] For example, incorporated companies are excluded from the definition of ‘agency’ in the Privacy Act.[49] Also, the term ‘organisation’ is defined to exclude an ‘agency’.[50] Acts of certain prescribed agencies, however, may be treated as acts of organisations.[51]

The Government’s policy is that bodies operating in the commercial sphere should operate on a level playing field. Where agencies are engaged in commercial activities, they should be required to comply with the NPPs, just like private sector organisations. [52]

26.36 The Privacy (Private Sector) Regulations 2001 (Cth) prescribe the Australian Government Solicitor and the Australian Industry Development Corporation as agencies to be treated as organisations under the Privacy Act.[53]

26.37 State and territory authorities fall outside the definition of ‘agency’ and are expressly excluded from the definition of ‘organisation’ under the Privacy Act.[54]However, they can be brought into the regime by regulation. A number of state authorities have been prescribed as organisations for the purposes of the Privacy Act, including, for example, Energy Australia and Integral Energy.[55]

26.38 State instrumentalities are treated as organisations under the Privacy Act unless they have been prescribed to fall outside of the definition of ‘organisation’ under s 6C(4) of the Privacy Act.[56] On the other hand, state and territory statutory corporations are excluded from the coverage of the Privacy Act.[57] The Revised Explanatory Memorandum to the Privacy Amendment (Private Sector) Bill 2000 noted that state and territory statutory corporations would not be caught by the definition of ‘organisation’, but that ‘Government Business Enterprises that are Corporations Law corporations’ would fall within the definition.[58] The latter therefore would be subject to the model ‘Direct Marketing’ principle in the same way as other organisations. The extent to which state and territory state-owned corporations, statutory corporations and government business enterprises should be regulated by the Privacy Act is discussed in Chapter 38.

26.39 Also relevant in this context is s 16F of the Privacy Act, which provides that personal information collected under a Commonwealth contract is not to be used or disclosed for direct marketing.

26.40 It appears that, currently, the Privacy Act is structured so that government business enterprises which operate in competition with private sector organisations generally will not be considered agencies for the purposes of the Privacy Act. In the context of other statutory regimes, however, the Government has expressed the policy position that, even if legislation technically does not apply to government bodies who are in competition with the private sector, it will be best practice for such government bodies to meet legislative requirements in relation to those commercial activities. For example, guidance published for government bodies on the Spam Act 2003 (Cth)considers the application of that legislation in circumstances where a government body may be commercialised or operating in a competitive environment. It states:

In these circumstances it is important that government is not perceived as having undue advantage. It is strongly recommended that you do not rely on the exemptions that apply to government bodies when sending commercial electronic messages. You should aim for best practice by ensuring you fully meet, or exceed, the requirements of the Spam Act.[59]

26.41 In DP 72, the ALRC asked whether agencies should be subject to the proposed ‘Direct Marketing’ principle and, if so, whether any exceptions or exemptions should apply specifically to agencies.[60]

Submissions and consultations

26.42 There was some support for the application of the principle to agencies.[61] The Law Council of Australia submitted that it was consistent with the proposal for one unified set of principles.[62] In a similar vein, PIAC submitted:

There has been an increasing tendency for government agencies to use direct marketing techniques to promote government services and programs. Extension of the direct marketing principle to cover agencies would also be consistent with Proposal 15–2 (the development of a single set of privacy principles applicable to both the public and the private sector). There should be exceptions in circumstances where government agencies have a legitimate reason for communicating information to individuals, eg public health and safety campaigns.[63]

26.43 The Australian Privacy Foundation and the Cyberspace Law and Policy Centre argued that ‘the boundaries between private and public sectors are increasingly blurred, and government agencies are now commonly undertaking direct marketing activities’.[64] The Cyberspace Law and Policy Centre noted that the equivalent principle in the Hong Kong Personal Data (Privacy) Ordinance[65] applies to all sectors and that the Hong Kong Privacy Commissioner has found public sector bodies in breach of it.[66]

26.44 Agencies submitted, however, that there is a legitimate distinction to be drawn between the direct marketing activities of organisations and those of agencies.[67] For example, Medicare submitted that the ‘Direct Marketing’ principle should not apply to agencies and stated that:

Government agencies would only be contacting individuals to offer and/or promote government services, as opposed to private sector enterprises who are trying to sell goods for their own commercial benefit. Government services are offered on the basis that they are of benefit to the public.[68]

26.45 The Australian Taxation Office (ATO) commented that it uses SMS as a means of reminding individuals about upcoming lodgement obligations and publications such as Activity Statement Updates to assist taxpayers to complete their Business Activity Statement correctly.[69] The ATO submitted that they did not see such activity as direct marketing and presumed that any ‘Direct Marketing’ principle would not apply to this kind of client contact.[70] The Department of Agriculture, Fisheries and Forestry submitted:

Agencies operate in the public interest, not their own commercial interests. This suggests different considerations should apply. Public-interest based marketing (eg a quarantine campaign) might be nullified or made largely ineffective if similar principles applied.[71]

26.46 This view was shared by the OPC, who submitted that the ‘Direct Marketing’ principle should not apply to agencies. While noting that it supported the minimisation of exceptions to the Privacy Act, the OPC recognised that it is a ‘legitimate function’ of agencies to ensure individuals are ‘kept informed of policies, services and entitlements relevant to them’.

Permitting individuals to opt-out of receiving this type of information from agencies may lessen the extent to which the community is aware of what the government is doing and what effect it may have on individuals.

Communications campaigns conducted by agencies are qualitatively different to the practice of ‘Direct Marketing’ in the private sector, in that they are not conducted primarily to generate a benefit or advantage to the entity, but rather to promote a fully informed constituency.[72]

26.47 The OPC acknowledged that ‘agencies do not have, and should not have, an unfettered right to use personal information to contact individuals for any purpose unrelated to their administrative and policy responsibilities’, but argued that this would be regulated by the ‘Use and Disclosure’ principle of the model UPPs.[73]

ALRC’s view

26.48 If the ‘Direct Marketing’ principle, in the form recommended by the ALRC, is made applicable to agencies, this could have a significant impact on the way in which government agencies communicate with individuals. In reaching this view, the ALRC understands that ‘agency’ will not generally include Commonwealth, state or territory commercial enterprises which are in competition with private sector organisations. The extent to which state and territory state-owned corporations, statutory corporations and government business enterprises should be regulated by the Privacy Act is considered in Chapter 38.[74] To the extent that any government body is engaged in commercial activities, it should adopt best practice by ensuring it meets the requirements applying to organisations under the ‘Direct Marketing’ principle. If the ‘Direct Marketing’ principle applied to agencies, it may preclude the legitimate communication of important information by agencies. The ‘Direct Marketing’ principle should not, therefore, apply to agencies.

[48] Office of the Federal Privacy Commissioner, Plain English Guidelines to Information Privacy Principles 1–3: Advice to Agencies about Collecting Personal Information (1994), 4.

[49] Privacy Act 1988 (Cth) s 6(1).

[50] Ibid s 6C(1). State and Territory instrumentalities will be caught by the definition of ‘organisation’ unless they are prescribed in regulations under s 6C(4) of the Privacy Act, which allows for regulations to be made to stop state or territory instrumentalities from being organisations for the purposes of the Privacy Act: Revised Explanatory Memorandum, Privacy Amendment (Private Sector) Bill 2000 (Cth), [74].

[51] Privacy Act 1988 (Cth) s 7A.

[52] Revised Explanatory Memorandum, Privacy Amendment (Private Sector) Bill 2000 (Cth), [102].

[53] Privacy Act 1988 (Cth) s 7A; Privacy (Private Sector) Regulations 2001 (Cth) cl 4.

[54] Privacy Act 1988 (Cth) ss 6(1), 6C.

[55] Ibid s 6F; Privacy (Private Sector) Regulations 2001 (Cth) cl 3A.

[56] Privacy Act 1988 (Cth) s 6F. See discussion in Ch 38.

[57] Ibid s 6C(3).

[58] The term ‘State or Territory authority’ is also defined to exclude ‘an incorporated company, society or association’. The Revised Explanatory Memorandum, Privacy Amendment (Private Sector) Bill 2000 (Cth), [73] states that state or territory authorities are, in general terms, defined to mean people or bodies that are part of the state or territory public sector. Local councils will generally fall within the definition of ‘State or Territory authority’. Government business enterprises may be excluded from the coverage of the Privacy Act if they are prescribed under s 6C(4).

[59] Australian Communications Authority, Spam Act 2003: A Practical Guide for Government, 1 April 2004, 13.

[60] Australian Law Reform Commission, Review of Australian Privacy Law, DP 72 (2007), Question 23–1.

[61] Australian Privacy Foundation, Submission PR 553, 2 January 2008; Australian Direct Marketing Association, Submission PR 543, 21 December 2007; Confidential, Submission PR 535, 21 December 2007; P Youngman, Submission PR 394, 7 December 2007.

[62] Law Council of Australia, Submission PR 527, 21 December 2007.

[63] Public Interest Advocacy Centre, Submission PR 548, 26 December 2007.

[64] Australian Privacy Foundation, Submission PR 553, 2 January 2008; Cyberspace Law and Policy Centre UNSW, Submission PR 487, 19 December 2007.

[65] Personal Data (Privacy) Ordinance (Hong Kong).

[66] Cyberspace Law and Policy Centre UNSW, Submission PR 487, 19 December 2007.

[67] Australian Government Department of Agriculture‚ Fisheries and Forestry, Submission PR 556, 7 January 2008; Australian Government Centrelink, Submission PR 555, 21 December 2007; Australian Government Department of Human Services, Submission PR 541, 21 December 2007; Medicare Australia, Submission PR 534, 21 December 2007.

[68] Medicare Australia, Submission PR 534, 21 December 2007.

[69] Australian Taxation Office, Submission PR 515, 21 December 2007.

[70] Ibid.

[71] Australian Government Department of Agriculture‚ Fisheries and Forestry, Submission PR 556, 7 January 2008.

[72] Office of the Privacy Commissioner, Submission PR 499, 20 December 2007.

[73] Ibid.

[74] See Recs 38–2, 38–3.